Analysis
- max time kernel
452s - max time network
1174s - platform
windows11-21h2_x64 - resource
win11-20240611-en - resource tags
- submitted
18/06/2024, 16:25
General
- Target source_prepared.exe
- Size 13.5MB
- Sample240618-tw3cqs1dkd
- SHA256 37b904f4f748507f3d599059f1e12095fe9e155450217b38de50f6ed72bb3c05
Malware Config
Signatures
- Loads dropped DLL 20 IoCs
- UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
_imaging.cp311-win_amd64.pyd
VCRUNTIME140.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp311-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python3.DLL
python311.dll
select.pyd
unicodedata.pyd
memory/4852-91-0x00007FF8AF6A0000-0x00007FF8AF6AD000-memory.dmp
memory/4852-111-0x00007FF899EE0000-0x00007FF89A409000-memory.dmp
memory/4852-62-0x00007FF8AC4F0000-0x00007FF8AC514000-memory.dmp
memory/4852-66-0x00007FF8AC4D0000-0x00007FF8AC4E9000-memory.dmp
memory/4852-85-0x00007FF8AC2C0000-0x00007FF8AC2D4000-memory.dmp
memory/4852-87-0x00007FF899EE0000-0x00007FF89A409000-memory.dmp
memory/4852-63-0x00007FF8B1720000-0x00007FF8B172F000-memory.dmp
memory/4852-90-0x00007FF8AC2A0000-0x00007FF8AC2B9000-memory.dmp
memory/4852-93-0x00007FF8ABA20000-0x00007FF8ABA56000-memory.dmp
memory/4852-95-0x00007FF8AEF10000-0x00007FF8AEF1D000-memory.dmp
memory/4852-97-0x00007FF8ABC00000-0x00007FF8ABC33000-memory.dmp
memory/4852-100-0x00007FF89A410000-0x00007FF89AA02000-memory.dmp
memory/4852-104-0x00007FF8ABAF0000-0x00007FF8ABB02000-memory.dmp
memory/4852-103-0x00007FF8ABB10000-0x00007FF8ABB25000-memory.dmp
memory/4852-102-0x00007FF8ABB30000-0x00007FF8ABBFD000-memory.dmp
memory/4852-107-0x00007FF8AB850000-0x00007FF8AB96C000-memory.dmp
memory/4852-52-0x00007FF89A410000-0x00007FF89AA02000-memory.dmp
memory/4852-109-0x00007FF8A7690000-0x00007FF8A78D5000-memory.dmp
memory/4852-110-0x00007FF8AC2C0000-0x00007FF8AC2D4000-memory.dmp
memory/4852-83-0x00007FF8AC2E0000-0x00007FF8AC30D000-memory.dmp
memory/4852-124-0x00007FF8ABB30000-0x00007FF8ABBFD000-memory.dmp
memory/4852-134-0x00007FF8AC2C0000-0x00007FF8AC2D4000-memory.dmp
memory/4852-141-0x00007FF8ABAF0000-0x00007FF8ABB02000-memory.dmp
memory/4852-140-0x00007FF8ABC00000-0x00007FF8ABC33000-memory.dmp
memory/4852-139-0x00007FF8AEF10000-0x00007FF8AEF1D000-memory.dmp
memory/4852-138-0x00007FF8ABA20000-0x00007FF8ABA56000-memory.dmp
memory/4852-137-0x00007FF8AF6A0000-0x00007FF8AF6AD000-memory.dmp
memory/4852-136-0x00007FF8AC2A0000-0x00007FF8AC2B9000-memory.dmp
memory/4852-135-0x00007FF899EE0000-0x00007FF89A409000-memory.dmp
memory/4852-133-0x00007FF8AC2E0000-0x00007FF8AC30D000-memory.dmp
memory/4852-132-0x00007FF8AC4D0000-0x00007FF8AC4E9000-memory.dmp
memory/4852-131-0x00007FF8B1720000-0x00007FF8B172F000-memory.dmp
memory/4852-130-0x00007FF8AC4F0000-0x00007FF8AC514000-memory.dmp
memory/4852-129-0x00007FF8ABB10000-0x00007FF8ABB25000-memory.dmp
memory/4852-128-0x00007FF8A7690000-0x00007FF8A78D5000-memory.dmp
memory/4852-127-0x00007FF8AB850000-0x00007FF8AB96C000-memory.dmp
memory/4852-112-0x00007FF89A410000-0x00007FF89AA02000-memory.dmp